Zero-day vulnerability

What it means

A zero-day vulnerability is a security flaw in software or hardware that the vendor does not yet know about, or knows about but has not yet patched. The name reflects that the vendor has had zero days to fix it. An attack exploiting such a flaw is called a zero-day exploit. Since no fix exists, normal updates do not protect against it.

Zero-day vulnerabilities are valuable, so they are used mainly by sophisticated attackers, organised groups and state actors, often in targeted attacks. Once the flaw is disclosed and a patch released, however, the exploit spreads quickly to ordinary attackers who go after systems not yet updated. For businesses the greatest risk therefore often comes after disclosure.

Defence cannot rely on a single layer. Since the flaw itself cannot be fixed, it matters to limit what an attacker can do after exploiting it and to detect the attack as early as possible. Several layers of protection are combined: the zero trust principle, network segmentation, least privilege and monitoring through SIEM and EDR.

How it works in practice

For a company the key is deploying patches quickly once the vendor releases them. Good patch management includes an inventory of all software, tracking security advisories, testing and deploying critical patches within days, not months. Internet-facing devices such as VPN gateways, firewalls and mail servers are most at risk.

Until a patch is available, vendors and security authorities often publish temporary mitigations: disabling the vulnerable feature, restricting access or a rule for the WAF. These recommendations should be followed and applied promptly. In Slovakia warnings are issued by the National Security Authority and its CSIRT unit.

Incident readiness matters as much as prevention. A company should have an incident response plan, backups separated from the network and tested recovery. If a system turns out to be compromised, it must be isolated, investigated and restored from a clean state, and if personal data leaked, the duty to notify assessed.

What to watch out for

The most common mistake is postponing updates for fear that something will stop working. After a patch is published, attackers analyse what it fixes and within days build attacks on unpatched systems. The window between release and deployment of a patch is therefore the riskiest period.

Watch out for forgotten and unsupported systems. Old servers, devices or applications the vendor no longer updates stay vulnerable for good. Keep a list of them and plan their replacement or at least isolation. A cyber insurer may refuse to pay if updates were neglected.